Discord security bot turns against its own users after hackers stole its identity

A security bot designed to protect Discord communities from fake accounts and banned users was hijacked and turned against the very servers it was supposed to defend.

Double Counter is a verification service that describes itself as the "largest Discord security network", capable of blocking "alt accounts, raids and VPNs in three seconds".

On October 4, 2026, it fell victim to a "deliberate, multi-stage attack".

The attacker broke into an old server using a vulnerability in an analytics tool, before using credentials found on the machine to access cloud infrastructure and evade containment measures.

Once inside the cloud infrastructure, the attacker granted themselves administrator privileges, published links to their own Discord server, copied database records and repeatedly regained access despite attempts to lock them out.

"During the attack they took control of the bot’s Discord token, used it to post links to their own Discord server in about 50 large servers, copied part of one of our databases, and used a stolen payment key to commit financial fraud on a separate account," Double Counter wrote.

"We cut off their access, found no persistence, replaced the exposed credentials and restored the service at 19:19. We sincerely apologise to everyone affected."

The criminal spent just under six hours in the cloud, copied about 12GB of data and made $7,316 worth of fraudulent charges on a separate payment account.

"Customer funds are safe," Double Counter said.

Sowing discord

In its incident report, the verification firm said the attacker exploited a vulnerability in an analytics tool still running on a retired server, then used administrator credentials left on the machine to access Double Counter’s cloud infrastructure without creating suspicious new accounts.

Defenders tried to revoke the attacker's service-account key, but the intruder simply switched to an administrator session, re-added an SSH key and connected to the database again.

When Double Counter set a new bot token in a bid to keep the threat actor out of its systems, it was read and compromised within just two minutes.

"They then deleted backups they had created, changed the database administrator password to lock our services out and started copying the databases they could find from a cloud-hosted machine until we located and terminated their session," Double Counter said.

READ MORE: "Apple engineer" builds GitHub AI torture chamber to inflict "pain and anguish" on models

Earlier in the attack, the intruder had opened a shell inside a running bot container and read its token, using it to grant themselves administrator rights and overturn a ban on their account before posting links to their own Discord server across 50 other servers. The largest was called "Steal a Brainrot".

Using a stolen service-account key, the attacker also added their own SSH key to the cloud project and exported one of Double Counter's databases into a storage bucket.

Messages sent using the stolen token bypassed Double Counter’s systems, forcing the company to identify affected servers through user reports and the bot’s message history.

Double Counter says it has cut off the attacker, shut down the vulnerable server, revoked and replaced compromised credentials, restricted database access and introduced tighter security monitoring. An audit of 14 cloud projects found no remaining backdoors.

Doogle users, advertisers and API customers have been warned that their email addresses were exposed and should be alert to phishing attacks. Discord server administrators should delete suspicious Double Counter invitations sent on October 4 between 12:00 and 16:30 UTC and check their audit logs. Ordinary users should avoid unexpected server invitations, while anyone who failed verification during the incident should try again.

You can see the full timeline of the attack below.

Trust no one, verify everything

The attack aligns with a wider trend in which hackers hijack trusted infrastructure and turn it against the people it was designed to serve, echoing a number of separate incidents in which attackers took control of ASOS's app to send push notifications to its customers, exploited Microsoft Teams to hide malicious communications and hijacked telecom routers to attack other networks.

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, told Machine: “The irony here is painful. A service specifically designed to protect Discord communities from malicious actors has become the source of one of the largest Discord-focused data exposures seen.

"A security tool becoming the source of a security breach is a reminder that trust in any platform should be proportional to how seriously it treats its own infrastructure. The nature of the data exposed creates specific downstream risks for gaming and Discord communities that are worth flagging.

READ MORE: “LLMs will be subverted”: Malware is evolving to attack AI defenders, SentinelOne warns

"Discord IDs combined with usernames and IP addresses are a useful toolkit for targeted harassment and account correlation across platforms. The immediate risk is phishing attempts referencing accurate Discord account details; users should treat any Discord-related communications with suspicion.”

In a statement, Discord said: "We’re aware of a security incident involving Double Counter, a third-party app available on Discord. While this was not a breach of Discord, we’ve disabled new installs of the app while we work with Double Counter to understand the full scope of the incident, and we’ll take further action as appropriate.”

Follow Machine